The vulnerability is an unauthenticated Cross Site Scripting flaw in the Trusted Shops Easy Integration for WooCommerce plugin versions 2.0.6 and earlier. Because the plugin does not properly sanitize user‑supplied input, an attacker can inject arbitrary JavaScript code that executes in the context of any user who views a page rendered by the plugin. The primary impact is that the attacker could steal session cookies, deface pages, or redirect users to phishing sites. This flaw is an input validation weakness identified by CWE‑79.

The flaw affects the Trusted Shops Easy Integration for WooCommerce plugin, developed by Vendidero, in all WordPress installations where the plugin version is 2.0.6 or lower. Site owners running an affected version on any WordPress environment are vulnerable to XSS attacks.

The CVSS v3.1 score of 7.1 indicates a moderate to high severity. Attackers can exploit the flaw by simply visiting the affected site; no authentication or special privileges are required. While the EPSS score is not available, the lack of a KEV listing suggests no widespread exploitation yet, but the inherent unauthenticated nature makes it a high‑priority target for attackers. Organizations should treat this as a serious web application risk until a patch is applied.